Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

troyhunt.com

Post reply on HN
Print view View original

31–40 of 175 posts

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#31

Post by AstralStorm »

mattbgates wrote: post #18

Companies have to get more involved in actually encrypting their data before entering it into the database. For every web app I create, especially when sensitive information is exposed, I try to encrypt as much data as possible. With all the leaks and hacks.. it only makes sense to add some encryption method in there.

Encryption does nothing if you can just query the decrypted data.

Other than giving a false sense of security.

Even if the database is encrypted, something has to access the decrypted data and is vulnerable to attack.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#32

Post by bigiain »

lvh wrote: post #9
dTal wrote: post #5

Okay, first of all: >the average parent.. is technically literate enough to know the wifi password but not savvy enough to understand how the "magic" of daddy talking to the kids through the bear (and vice versa) actually works [or] that every one of those recordings... is stored as an audio file on the web. If it is not considered amazingly stupid, or at least ignorant to not understand that the magic talking bear h…

A device connecting to your WiFi could just be talking to devices on your network, not necessarily be sending all of your data to the Internet.

Sure - they _could_, but I've got lightbulbs and power switches that "helpfully" connect to some un branded Chinese "cloud" service - without any normal-user way to even know about it never mind turn it off.

I suspect some of it is so I've got the amazingly useful (nb: may not be useful at all) feature of being able to turn my lounge room lights on and off from my phone while not at home.

Cynical me suspects it's also probably a pretty good way to ensure forced just-put-of-warranty failures...

Pessimist-me assumes the Russians, the Chinese, Mossad, and some kid at the local hackerspace have all pwned the Chines cloud infrastructure and are using backdoor root shells on light globes subversive tshirt purchase history, and they're all cutting each other's throat price discounting as they sell it all as "business intelligence" to my car insurance company and the CBP...

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#34

Post by semiquaver »

Kiro wrote: post #26

> As you can see by loading the image, all that's required to access the file is the path which is returned by the app every time my profile is loaded. How else would you do it?

http://docs.aws.amazon.com/AmazonS3/latest/dev/ShareObjectPr...

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#35

Post by Crosseye_Jack »

Kiro wrote: post #26

> As you can see by loading the image, all that's required to access the file is the path which is returned by the app every time my profile is loaded. How else would you do it?

Well your correct that a valid address would be needed to access the content. But if you are being told by an api to access Z content it's easy to say "here is a sig that's only valid for the next x mins" (x being something you base on your user base) instead of anyone knowing the file name of the file (which they can get from dumping your db) from access the file without having that extra layer of protection.

Disable indexing on s3 and you need to know the direct link. Dump the table to get those links but then you still need to know the secret your app shares with s3 to create the sig needed to download from s3. I.E. They need to know Z and X and X only gets issued to people logged in and expires after a time. Knowing Z alone gets you nothing.

I do the same to protect the s3 bucket from direct access our cache pulls from (cache has a shared secret with s3 to pull from. Cache also has another signing process for the client to use to download from the cache). Client Signing for Z file is not valid for client+1. We just use a cache in-between client and s3 as we managed to get a deal thats cheaper for us then direct access to s3. But the same could be done for direct client to s3.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#37

Post by simplemath »

Mister_Snuggles wrote: post #24
simplemath wrote: post #8

IoT should die a swift and permanent death. Alas, that wont happen.

I'd love to see the INTERNET of Things be replaced by the INTRANET of Things. Remote access can be handled through a VPN, so there's no need for a remote server. I'm assuming that the device in question has computing hardware that's at least on par with a $9 CHIP. What's really needed is for secure and easy to set up VPNs (to connect back to your home network) to become a thing, then the remote access problems are ta…

whats really needed is an actual un-fucked-with consumer grade encryption standard that is headless, touchless and on forever with no offswitch.

Alas, that wont happen either

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#38

Post by cgriswald »

Mister_Snuggles wrote: post #24
simplemath wrote: post #8

IoT should die a swift and permanent death. Alas, that wont happen.

I'd love to see the INTERNET of Things be replaced by the INTRANET of Things. Remote access can be handled through a VPN, so there's no need for a remote server. I'm assuming that the device in question has computing hardware that's at least on par with a $9 CHIP. What's really needed is for secure and easy to set up VPNs (to connect back to your home network) to become a thing, then the remote access problems are ta…

Agreed.

A bear that records voices and gives remote access should not need to store data on a server. Store the data in the bear. That's the way these types of bears have always been. The only thing new here is remote access...

Storing my kid's private voice recordings on your server is just plain creepy even if you don't leave it wide open.

Re: CloudPets teddy bears leaked and ransomed, exposing kids' voice messages

#40

Post by walrus01 »

orf wrote: post #4

A guy I work with did a presentation on this product, he is big into reverse engineering bluetooth devices. I can assure you the toys themselves are just as insecure as apparently their infrastructure is. Seeing it light up and say "destroy all humans" was pretty funny, moreso because there is pretty much zero authentication on them so you could do it from anywhere from your mobile, and the mic can turn on and record…

Reading and fully comprehending the full contents and implications of https://twitter.com/internetofshit should be required for anyone who is thinking about making an IOT type device.
Post reply on HN